Overview

overview

10

Static

static

3

oglcache.exe

windows7-x64

10

oglcache.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    2f30cb924d2e28aabd74f9aaa538c45c_JaffaCakes118

  • Size

    166KB

  • Sample

    240510-p2t64afd4t

  • MD5

    2f30cb924d2e28aabd74f9aaa538c45c

  • SHA1

    bf12c9a0ded49bb6d9b614de646aebc99d52a32e

  • SHA256

    968536a19c000fa548ed630f4a248eff791997754b1d0ccfea925bcd061625bb

  • SHA512

    0d3f9a70e439062e621a99496e747ebfa416a65d0fe7a806b02d33b9ef9ba0a997a32d0de4694b49dcd9d82b14705bf3a7bf7969d07767ac71ecc604b5ad96d7

  • SSDEEP

    3072:XbL93uG6BFezLx3u9LPUJyWRbCSWgxQIJGq65Sy7FuQsiWJa1ADm56TzkVa:rxVM0zxSGyWXWgxRJn6IyhuQsWWq56PB

Score
10/10
netwirebotnetpersistenceratstealer

Malware Config

Targets

    • Target

      oglcache.exe

    • Size

      301KB

    • MD5

      fcb719e28da41dd7443017eb1f456ff3

    • SHA1

      cc1e37fc84fe746523a1413989fb29a9e72d12c9

    • SHA256

      2b2668fa5331ffa99fc11d881fbce91927bfac1a8ec5705b6412c7903543116a

    • SHA512

      fb1d2bad04d248f6f13ba06238714b412f27cc0972f4d4a92ab01e2b9154f0094dbec496b800d7c59d4c2ad1d882927c50c111d504c5e51144ff25ef0bdbdb86

    • SSDEEP

      6144:UjuQW8XJjgbWXwGp7h5qN/Ay8ouP+BlwAIJ:pQ9X9gbWXVpzq9Ay8ou+Blw

    Score
    10/10
    netwirebotnetpersistenceratstealer

    • NetWire RAT payload

      rat

    • Netwire

      Netwire is a RAT with main functionalities focused password stealing and keylogging, but also includes remote control capabilities as well.

      botnetstealernetwire

    • Modifies Installed Components in the registry

      persistence

    • Executes dropped EXE

    • Loads dropped DLL

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks